This repository has no description
2configs.c-base-ai-tunnel, neoprism: forward c-base ollama over retiolum
Persistent autossh tunnel via tunnel.c-base.org exposing
ai.cbrp3.c-base.org:11434 on neoprism, reachable from retiolum at
neoprism.r:11434. ssh key generated by clan vars; pubkey must be
installed on tunnel.c-base.org under lassulus before the tunnel comes up.
author
lassulus
date
(May 13, 2026, 1:03 PM CEST)
commit
b816d448
b816d44854e7502e5ac4074c544f696e723ce47f
parent
68e5ec94
68e5ec9431675bfb663339c030f4c46fc5c1b516
+59
+56
2configs/c-base-ai-tunnel.nix
+56
2configs/c-base-ai-tunnel.nix
···
1
+
{ config, pkgs, ... }:
2
+
let
3
+
cbaseUser = "lassulus";
4
+
cbaseHost = "tunnel.c-base.org";
5
+
remoteHost = "ai.cbrp3.c-base.org";
6
+
port = 11434;
7
+
sshKey = config.clan.core.vars.generators.c-base-ai-tunnel.files."id_ed25519".path;
8
+
knownHosts = pkgs.writeText "c-base-ai-tunnel-known_hosts" ''
9
+
tunnel.c-base.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKDknNl4M2WZChp1N/eRIpem2AEOceGIqvjo0ptBuwxUn0w0B8MGTVqoI+pnUVypORJRoNrLPOAkmEVr32BDN3E=
10
+
tunnel.c-base.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDgTvns7Gh4smL6kyau2TpVz35z5rJgmI7B/nSYKr/nD203ZJIkZkwHe/yHCz1AwTjx0/tg75lxrz5fGZLATAlS/gXsf97T+2m9XkXRShva5t8WJNUxktOySLv8X68VKYqN3GPgdi2p+4A1yAZvIERIHCS7fJ5wvbe41Z+vABxeVQ1aR48Q0YQ4v4q9KlpoRvU5U9QdHjVZxHkIu5GeMcD+uh54eEvbwdk0sYcF5/fO+tsz0yS3uyMnGOq718UMWHRLiubCJCPefz7FlGBRfbAFArIp7QF7BMWox6YZIk1aCDfB+0U/Tk8Mhp0B4twq5xRaTqOSkHl9QuBUvrKjR0S9
11
+
'';
12
+
in
13
+
{
14
+
clan.core.vars.generators.c-base-ai-tunnel = {
15
+
files."id_ed25519" = {
16
+
owner = "c-base-tunnel";
17
+
mode = "0400";
18
+
};
19
+
files."id_ed25519.pub".secret = false;
20
+
runtimeInputs = with pkgs; [ openssh ];
21
+
script = ''
22
+
ssh-keygen -t ed25519 -N "" -C "neoprism c-base ai tunnel" -f "$out/id_ed25519"
23
+
'';
24
+
};
25
+
26
+
users.users.c-base-tunnel = {
27
+
isSystemUser = true;
28
+
group = "c-base-tunnel";
29
+
home = "/var/lib/c-base-tunnel";
30
+
createHome = true;
31
+
shell = pkgs.bashInteractive;
32
+
};
33
+
users.groups.c-base-tunnel = { };
34
+
35
+
services.autossh.sessions = [
36
+
{
37
+
name = "c-base-ai";
38
+
user = "c-base-tunnel";
39
+
monitoringPort = 0;
40
+
extraArguments = builtins.concatStringsSep " " [
41
+
"-N"
42
+
"-o ServerAliveInterval=30"
43
+
"-o ServerAliveCountMax=3"
44
+
"-o ExitOnForwardFailure=yes"
45
+
"-o StrictHostKeyChecking=yes"
46
+
"-o UserKnownHostsFile=${knownHosts}"
47
+
"-o IdentitiesOnly=yes"
48
+
"-i ${sshKey}"
49
+
"-L *:${toString port}:${remoteHost}:${toString port}"
50
+
"${cbaseUser}@${cbaseHost}"
51
+
];
52
+
}
53
+
];
54
+
55
+
networking.firewall.interfaces.retiolum.allowedTCPPorts = [ port ];
56
+
}